chore(superagent): add Superagent config with contributor-trust disabled - #5670
Merged
Conversation
This repo had no .github/superagent.yml, so the app was running on Superagent's own defaults -- including contributor-trust scoring, with no way to configure it from the repo. Add the config explicitly, matching JSONbored/loopover and JSONbored/metagraphed: prScan enabled (it gates CI and is the protection worth having), contributorTrust disabled. Contributor trust does not discriminate here -- established repeat contributors with dozens of merged PRs were scored 'dangerous' (10/100) on volume alone -- and the trustedAuthors allowlist meant to fix that provably does not work: a listed author was still flagged action_required. It is omitted rather than carried along inert and misleading. The verdict also has no consumer: LoopOver lists this check under gate.ignoredCheckRuns on all three gate repos, so a non-passing result no longer gates, pends, or holds anything.
|
Important 🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨 ⏳ LoopOver is waiting…LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs. 🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the set with JSONbored/loopover#9818 and JSONbored/metagraphed#8684 — all three gate repos now carry the same Superagent configuration.
Why this repo needs a new file
Unlike the other two, awesome-claude had no
.github/superagent.ymlat all, so the app was running on Superagent's own defaults — including contributor-trust scoring, with no repo-level way to turn it off.What it sets
prScan: enabled— the Superagent Security Scan keeps gating CI. That's the protection worth having.contributorTrust: enabled: false— it doesn't discriminate on these repos: established repeat contributors with dozens of merged PRs were scored "dangerous" (10/100) on volume and velocity alone.trustedAuthorsis deliberately not carried over. The other two repos had it, it was added to solve exactly this problem, and it provably does not work — a listed author (shin-core) was still flaggedaction_requiredon loopover#9816. An allowlist that doesn't allow is worse than none: it looks handled while every affected PR still stalls. Better omitted than kept inert and misleading.Layering
LoopOver already lists this check under
gate.ignoredCheckRuns(loopover#9813) on all three gate repos, so a non-passing result no longer gates, pends, or holds anything regardless. This removes the noise at the source; the ignore stays as defence-in-depth.